Hacker News Reader

Comment by 2ton_jeff | Hacker News Reader

ErrataSec hit it in one IMO:

http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-non...

"An even funner talk, which I've long wanted to do, is to do the same thing with cell phones. Take a cellphone, pull it apart, disconnect the antenna, then connect it to a highly directional antenna pointed at a distant cell tower -- several cells away. You'd then be physically nowhere near where the cell tower thinks you are."

That would be interesting.

Wouldn't it be easier to get $20 USB modem with dedicated antenna connector?

You'd still need to be careful about device IMEI, how you get your SIM card and load with credits.

If it became known to be deployed, what's the bet some Erlang hacker upgrades the cell tower firmware to detect probable directional antennae?

How would that potentially work? Well, I'm no radio engineer but I know it's possible. Normally you receive signals of varying strength as users move throughout your cell. I'm fairly certain that sub-cell positioning metrics are already developed on the change between these various known signal states and directions. One would simply pick outliers (eg. with constant signal strength, or constant direction).

Why Erlang?

I assume he was referring to how a series of popular telephone switches from Ericsson had their software written in Erlang.

The towers themselves would just be a mishmash of DSPery and C/C++, however. Probably, anyways.

An Erlang is a unit of load on a cell tower (or more generally in any telephony circuit).

Edit: Not sure if this is what the parent was referring to, but if the tower software was written in Erlang, it's certainly an interesting coincidence.

This would be really easy by correlating signal strength measurements from several towers. Then, an analysis of these data would reveal unusual patterns that differ from what would result with the common isotropic antenna.

This kind of correlation is already in use by mobile networks to narrow the location of emergency calls from handsets that are not sending GPS or other positional data.

What about people like me, who live with in range of just one cell tower. When ever I am within range of my cell tower at home, my signal always comes from the same direction, and roughly with the same signal strength. So far I have yet to be disconnected, though who knows, maybe I am flagged for suspicious activity :)

> You'd then be physically nowhere near where the cell tower thinks you are

This wouldn't work with TDM networks (like GSM).

The cellphone periodically has to produce a timing advance offset, so that the phone can send the signals ahead of its time slot, to arrive at the tower when its time-slot is active.

So effectively, your phone measures light-path distance between the tower and your phone periodically, with the help of the tower (this happens in 1/2 km steps).

This however isn't triangulation, so all my attempts to use TA + tower location to make a fake GPS (way back in 2004) ended up giving me erratic movements as I went up and down (and behind buildings).

Faking Timing Advance would be near impossible, because it uses light speed (on the given day's humidity etc).

I personally think the arstechnica link should be replaced with this one.

Reply on news.ycombinator.com